Possible False Positive, rightsnet.org.uk

[nukecad]

For some reason MBG Firefox today decided to block 'https://www.rightsnet.org.uk/' due to riskware.

This is a website and forum for professional welfare advisors (you need to be employed as an advisor to join) that I visit daily, it's never been a problem before today.

It is remotely possible that there are some downloadable benefit/pension/other calculation tools on there that may have caused the flag, either something new/updated or MBG has changed it's detections and is picking up something it ignored before?

Please could you check it, thanks.

[1PW]

https://www.virustotal.com/gui/url/e4940feb1d5d503c7ea1cc5aad2d6d375abdfc6f9ad01696a51ed018c634ba21/detection

[nukecad]

Sorry I meant check the FP block in MBG,  I knew VT would show the site as clean and had no qualms making it an exception.

There is/was just that slight possibility of one of the downloadables causing a detection though.

[nukecad]

The block appears to have been lifted today. (I think it was possibly a temporary bock by MBG on all '.org.uk' domains?).

[grahamperrin]

I do get a block on org.uk (and still, on the URL in the opening post).

[nukecad]

I spoke too soon - the block on rightsnet is back again.

It does seem to be a blanket domain block on ".org.uk" I have had others today as well.

eg. "www.diydoctor.org.uk" is also blocked by MBG for 'riskware'.

[nukecad]

We seem to be getting more posts confirming this sudden blanket ban on whatever.org.uk

We could blame Brexit for UK sites suddenly being blocked by the rest of the world.

But I suspect that it's the 'double dot' that may be the problem.

[gonzo]

I observed the block as well.  I created a whitelist entry for this site.  Give it a few minutes and try again.

[nukecad]

Cheers gonzo, I'll check it later.

Have you just whitelested rightsnet, or all .org.uk domains?

I note there are even more reports of .org.uk blanket blocking in the Chrome MBG forum.

[nukecad]

No whitelist.

All .org.uk sites are being blocked for me at the moment unless I make them an exception or disable/uninstall MBG.

Come on Malwarebytes, a TLD block on .org.uk?

I have always though TLD blocks are overkill, to me it seems a lazy way of doing things.
Don't allow connections to any sites on a domain and you stand zero chance of getting infected from those sites.
Whilst it will always work it's not quite what users expect.

 

[gatortail]

This should be resolved, please give it to the top of the hour to propagate out.

[nukecad]

Seems fine for all .org.uk now, thanks.

[gatortail]

Thanks for confirming and your support.